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FOR  THE  EXCLUSIVE  USE  OF  THE  INTERPRETATION  SERVICE  OF 
OF  THE  COURT  OF  JUSTICE  OF  THE  EU 

At  the  Oral  Hearing  on  24th  March  2015  in  Case  C-362/14: 

MAXIMILLIAN  SCHREMS 

Applicant 

V. 

DATA  PROTECTION  COMMISSIONER 

Respondent 

AND 

DIGITAL  RIGHTS  IRELAND  LIMITED 

Amicus  curiae 


Oral  Speaking  Notes  of  Maximillian  Schrems 


Pleading:  Noel  J.  Travers,  Senior  Counsel,  Bar  of  Ireland  and 

Professor  Dr.  Herwig  Hofmann,  Rechsanwalt,  Cologne  Bar 
(Germany). 

With  them,  Mr.  Paul  O’Shea,  Barrister,  Bar  of  Ireland. 

Instructed  by:  Mr.  Gerard  Rudden,  Solicitor,  Ahern  Rudden  Solicitors,  5 
Clare  Street,  Dublin  2,  Ireland. 

President,  Members  of  the  Court,  Advocate  General 
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I.  Introduction 

1.  Mr.  Schrems  is  a European  Facebook  user.  He  has  complained 
about  the  transfer  of  his  personal  data  by  Facebook  Ireland  to 
Facebook  in  the  USA.  There,  under  US  law,  that  data  is  subject  to 
‘mass  and  indiscriminate’  general  surveillance.  We  submit  that 
such  a form  of  mass  surveillance  is  manifestly  incompatible  with 
the  fundamental  right  to  privacy  and  data  protection  for  which 
Union  law  provides.  Some  of  those  who  have  submitted  written 
observations,  most  notably  the  Commission,  the  DPC  and  the  UK, 
appear  to  think  that  a finding  under  Article  25  of  Directive  95/46 
may  override  higher  ranking  EU  law.  We  disagree  and  observe 
that  the  Commission’s  position  is  plainly  at  odds  with  that  set  out  in 
its  2013  Communications,  referred  to  in  the  Court’s  third  set  of 
questions. 


II.  More  serious  breach  here  than  in  Digital  Rights  Ireland 

2.  In  Digital  Rights  Ireland  you  held  that  indiscriminate  retention 
within  the  EU  of  data  provided  for  by  Directive  2006/24  (the  Data 
Retention  Directive)  was  incompatible  with  the  fundamental  right  to 
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privacy  guaranteed  by  Union  law,  and  annulled  that  Directive.  We 
welcome  that  judgment.  The  principles  it  so  clearly  enunciates 
apply  a fortiori  to  the  far  more  egregious  breach  of  the  right  to 
privacy  involved  in  this  case. 

3.  It  involves  surveillance  that  is  manifestly  incompatible  under 
Articles  7 and  8 of  the  Charter  - especially  when  taking  into 
consideration  that  you  held  in  Digital  Rights  Ireland  that  even 
limiting  surveillance  to  a mere  retention  of  data,  and 
notwithstanding  that  the  Data  Retention  Directive  at  issue  imposed 
time  limits  and  allowed  citizens  judicial  redress,  it  was  incompatible 
with  Articles  7 and  8 of  the  Charter.  Here,  the  relevant  US 
surveillance  laws  lack  all  of  these  elements  - amounting  to  an 
unfettered  surveillance  of  all  personal  data  of  non-US  citizens. 

4.  The  interference  is  so  serious  that  it  violates,  as  the  European 
Parliament  and  Italy  also  submit,  the  essence  of  the  right  to 
privacy  and  data  protection  under  the  Charter.  This  is  clear  from 
the  finding  in  Digital  Rights  Ireland,  where  you  held  (paragraph 
39),  that  Data  Retention  Directive  did  not  as  such  adversely  affect 
the  essence  of  those  rights  because  it  “does  not  permit  the 
acquisition  of  knowledge  of  the  content  of  the  electronic 
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communications.”  US  surveillance  does  exactly  that:  it  grants 
access  to  the  content  of  all  data. 

5.  US  law  allows,  as  the  referring  court  has  found,  permits  “mass  and 
undifferentiated ’ surveillance  by  its  public  authorities  to  personal 
data  “on  a casual  or  generalised  basis”,  in  circumstances  where 
those  authorities  are  not  even  required  to  provide  “ objective 
justification”.  Critically,  as  the  referring  court  has  further  found,  the 
available  access  is  neither  “ based  on  considerations  of  national 
security’  nor  on  “the  prevention  of  crime  specific  to  the  individuaf’. 
Moreover,  the  access  is  not  “ attended  by  appropriate  and  verifiable 
safeguards”. 

6.  It  is  difficult  to  conceive  of  a more  serious  violation  of  the  essence 
of  fundamental  right  in  EU  law  to  personal  data  privacy.  It  is 
manifestly  more  serious  than  the  “ wide-ranging  particularly  serious 
interference ” identified  and  declared  disproportional  in  Digital 
Rights  Ireland  (at  paras  37  and  65). 

III.  Validity  of  the  so-called  ‘Safe  Harbour  Decision’,  Decision 


2000/520 
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7.  By  finding  adequacy  in  the  light  of  these  facts,  the  Decision 
2000/520  violates  both  its  own  legal  basis  (Article  25  of  Directive 
95/46)  and  higher  ranking  Union  law.  I will  address  validity  by 
reference  to  legal  base  in  answering  the  Court’s  questions. 

• Decision’s  Compatibility  with  Higher-ranking  Union  Law 

8.  Measures  based  on  Directive  95/46  - as  in  fact  any  measure  taken 
by  any  EU  institution  - must  comply  with  EU  fundamental  rights, 
as  explicitly  confirmed  in  the  Kadi  case-law.  Article  1(1)  of 
Directive  95/46  specifies  its  objective  as  being  to  protect 
“fundamental  rights”,  particularly  the  “right  to  privacy  with  regard  to 
the  processing  of  personal  data”.  From  this,  it  is  clear  that  the 
right  to  privacy  offers  protection  against  both  public  and  private 
infringements. 

9.  The  possibility  of  generalised  surveillance  by  US  security 
agencies  of  data  transferred  for  storage  at  Facebook  Inc.  (USA)  by 
Facebook  Ireland,  under  domestic  US  legislation  like  the  Foreign 
Intelligence  Services  Act  (FISA)  manifestly  comprises  a form  of 
processing  and,  thus,  an  interference  with  the  data  subjects’ 
fundamental  rights.  There  is  no  protection  from  such  interference 


in  the  USA. 
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10.  Although  the  questions  referred  do  not  formally  concern  the 
validity  of  Decision  2000/520,  it  has  been  clear  since  your  early 
case-law  in  Case  1 6/65  Schwarze1  that,  when  interpretation  of  an 
act  is  requested  in  a preliminary  reference,  the  Court  is  entitled 
firstly  to  consider  the  act’s  validity.  In  any  event,  we  submit  that 
the  order  for  reference  and  the  questions  referred  raise,  by 
necessary  implication,  the  validity  of  the  Decision,  and  invalid  we 
submit  it  is. 

IV.  CJEU’s  Written  Questions  for  Definition  of  Position 

11.  Turning  rapidly  to  the  Court’s  written  questions,  we  will  seek  to 
define  our  position  with  regard  to  them  succinctly.  Underlying  our 
position,  is  the  duty  of  national  authorities  and  the  Commission  to 
protect  against  the  violations  of  the  right  to  privacy. 

• Question  1 

1 2.  By  the  introduction  to  and  the  first  two  parts  of  its  first  question. 

the  Court  identifies  the  obligation  of  the  Commission  to  interpret  its 
power  under  Article  25  of  the  Directive  in  the  light  of  the  overriding 
requirements  of  the  fundamental  right  to  privacy.  Compliance 


1 [1 965]  ECR  886. 
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therewith  is  a precondition  for  the  valid  adoption  by  the 
Commission  of  a decision  under  Article  25. 

13.  Although  Member  States  national  supervisory  authorities  are  of 
course  bound  by  the  laws  that  apply  to  them,  they,  of  course, 
include  EU  fundamental  rights.  However,  any  such  national  legal 
provision  cannot,  whether  on  its  face  or  by  interpretation,  have  the 
effect  of  precluding  such  an  authority  from  carrying  out  an 
independent  investigation  of  a reasoned  complaint. 

14.  It  would  be  the  very  antithesis  of  independence,  if  a supervisory 
authority  were  to  be  “absolutely  bound ’ by  a finding  of  fact  in  a 
Commission  decision  under  Article  25(6).  Consequently,  our 
position  is  that  national  authorities  established  pursuant  to  Chapter 
VI  of  the  Directive,  when  called  upon  by  a complaint  to  investigate 
the  adequacy  of  protection  provided  for  in  a third  country,  have  the 
duty  to  investigate  the  complaint. 

15.  Regarding,  the  third  part  of  the  first  question,  any  rules 
governing  the  limitation  of  international  data  transfers  must  allow 
national  supervisory  authorities  to  protect  the  fundamental  rights  of 
the  data  subject.  Article  3(1  )(b)  of  the  Decision  does  not  even 
allow  this  basic  leeway.  Of  its  cumulative  requirements,  the  first 
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relates  to  the  compliance  with  the  SHPs.  It  requires  that  the 
annexed  self-described  “Safe  Harbour  Principles”  (“SHPs”)  are 
being  violated.  Consequently,  it  requires  that  an  annexed,  foreign 
text  to  the  Decision,  which  text  is  subject,  as  to  both  its 
interpretation  and  compliance,  to  US  law  (see  6th  paragraph  of  the 
SHPs  in  Annex  I)  be  violated,  in  circumstances  where  the  text  itself 
is  also  subject  to  any  overriding  legal  act  under  US  law  (see  4th 
subparagraph,  SHPs).  This  is  a wholly  unacceptable  benchmark 
for  possible  intervention  by  national  supervisory  authorities.  It 
plainly  prevents  them  from  performing  their  duty  to  protect  the 
fundamental  rights  of  Union  data  subjects  whose  personal  data  is 
transferred  to  the  USA. 

16.  The  Commission  and  some  of  the  intervening  Member  States  refer 
to  the  reference  to  “ necessar y”  in  the  fourth  subparagraph  of  the 
SHPs  to  claim  that  this  allows  the  application  of  an  EU-law  type 
proportionality  requirement.  Nothing  could  be  further  from  the 
truth.  As  is  clear  from  the  fourth  paragraph  of  the  SHPs,  the 
reference  is  either  to  foreign  public  interest  or  to  what  is  necessary 
to  comply  with  any  legal  act  under  US  law,  such  as  the  FISA. 

17.  As  for  the  Commission’s  argument  in  its  written  observation 
relating  to  the  third  of  the  cumulative  requirements  in  Article 
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3(1  )(b),  i.e.  the  need  to  demonstrate  an  imminent  risk  of  grave 
harm,  we  submit  that  a breach  of  the  essence  of  a fundamental 
right,  such  as  the  right  to  privacy  and  data  protection,  comprises 
manifestly  harm  of  the  most  grave  and  serious  kind. 

18.  If,  however,  the  Court  considers,  notwithstanding  our  submissions, 
that  Article  3(1  )(b)  may  be  interpreted  in  a manner  that  renders  it 
compatible  with  the  Directive  and  higher-ranking  Union  law,  we 
submit  that  a national  authority  in  the  position  of  the  respondent 
DPC  in  this  case  has  a duty  to  investigate  the  complaint  and 
suspend  data  flows  to  the  USA,  as  submitted  by  Poland,  Austria 
and  Slovenia. 

• Question  2 

19.  Briefly,  with  regard  to  the  first  part  of  the  second  question,  our 

position  is  that  an  “adequacy  decision”  under  Article  25(6)  of 
Directive  95/46  must  fulfil  both  the  material  requirement  under 
Article  25(2),  which  sets  out  and  defines  a requisite  “adequate 
level  of  protection”  and  the  additional  formal  requirement  under 
Article  25(6)  for  such  an  “adequacy  finding”;  i.e.  that  the  protection 
must  be  provided  by  a “ domestic  laW’  or  by  a binding  “ international 
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commitment  by  the  third  country  concerned  as  an  international 
legal  person. 

20.  The  SHPs,  which  is  all  that  the  Decision  concerns,  fall  plainly  short 
of  both  requirements. 

21 . Obviously,  those  self-styled  principles  do  not  comprise  a “law”  or 
an  “international  commitment”,  cognisable  under  the  Vienna 
Convention  on  the  law  of  Treaties  They  are  a mere  publication  of 
self-styled  “principles”  and  so-called  “frequently  asked  questions” 
that  appear  on  a webpage  of  a US  government  department,  the 
US  Department  of  Commerce. 

22.  With  regard  to  the  material  level  of  protection,  we  rely  fully  upon 
our  detailed  written  observations  and  upon  the  in-depth  analysis  of 
Professor  Boehm  at  Annex  A.1  thereto  regarding  the  adequacy  of 
privacy  protection  under  the  SHPs  and  FAQS. 

23.  In  summary,  self-certification  under  the  SHPs  by  entitles  like 
Facebook  Inc.,  especially  if  overruled  by  laws  like  the  FISA,  cannot 
provide  adequate  protection  under  Article  25  of  the  Directive.  This 
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is  a fortiori  the  case  as  the  SHPs  do  not  apply  to  US  public 
authorities. 

24.  Regarding  the  second  part  of  the  second  question  of  the  Court, 
our  position  is  yes:  a genuine  “adequate  level  of  protection”  under 
Article  25  of  Directive  95/46  would  manifestly  require,  having 
regard  to  the  need  to  ensure  that  effect  is  given  to  Article  47  of  the 
Charter  and  Article  8(3)  thereof,  in  particular,  as  regards  data 
protection,  as  well  as  Article  13  of  the  ECHR,  the  availability  of  an 
effective  judicial  remedy  for  data  subjects  in  the  third  country 
concerned. 

25.  Regarding  penultimately  the  third  part  of  the  second  question, 

although  the  Decision  was  adopted  before  the  Charter  entered  into 
force,  our  position  is  that  privacy  protection  was  assured,  at  the 
time,  by  the  general  principles  of  EU  law  arising  from  the  ECHR 
and  constitutional  traditions  in  particular.  The  main  problems  with 
the  Decision  all  existed  also  at  the  time  of  its  adoption.  In 
particular,  it  was  uncontested  that  the  formal  requirements  of 
Article  25(2)  of  the  Directive  were  not  satisfied  by  the  US  legal 
system.  We  refer,  in  particular,  to  Professor  Boehm’s  analysis  in 
the  Annex  I to  our  written  observations  and  to  paragraphs  30-33  of 


those  observations. 
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• Question  3 

26.  Finally  regarding  the  third  question,  our  position  is  that  the 
Commission  has  stated  publicly  on  multiple  occasions  that  the 
Decision  needs  to  be  corrected.  It  was  illegal  then  over  15  years 
ago  and  it  is  even  more  illegal  now.  Indeed,  it  was  clear  from 
recital  5 to  the  Decision  2000/520  that  there  was,  even  in  July 
2000,  merely  an  aspiration  by  the  Commission  that  the  SHPs 
would  achieve  their  stated  objective  of  adequate  protection. 
However,  the  Kadi  case-law  makes  clear  that  respect  for 
fundamental  rights  is  a condition  for  the  validity  of  Union  acts. 
Thus,  once  it  became  clear  to  the  Commission  that  its  aspiration 
was  hopelessly  optimistic  as  regards  the  USA,  it  should  have 
suspended  Decision  2000/520. 

27.  Finally,  invalidating  the  Decision  would  merely  place  those  US 
companies  who  have  self-certified  into  the  normal  position  in  which 
virtually  all  other  non-EU  companies,  including  may  US 
companies,  are. 


V.  Conclusion 
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28.  Accordingly,  we  respectfully  request  the  Court  to  answer  the 
questions  referred  as  proposed  in  paragraph  77  of  our  written 
observations. 


